owasp-modsecurity / owasp-modsecurity/ModSecurity
Regular Expression Failure Triggers `!@rx`
@airween is already working on this.
Since Apr 19, 2024.
- Dominant language
- C++
- Stars
- 9.8k
- Forks
- 1.8k
- Avg merge
- 2h 46m
- Merged PRs (30d)
- 1
Description
Describe the bug
When there's a regular expression error due to SecPcreMatchLimit or SecPcreMatchLimitRecursion (i.e. MSC_PCRE_LIMITS_EXCEEDED), a rule using !@rx will say that the rule was triggered. However, failures with @rx will say that the rule was not triggered. I think both should assume the rule was not triggered. See https://github.com/coreruleset/coreruleset/issues/3640#issuecomment-2035841946 for additional context.
To Reproduce
See https://github.com/coreruleset/coreruleset/issues/3640#issuecomment-2037347642.
You can probably reproduce by setting SecPcreMatchLimit and SecPcreMatchLimitRecursion really low (maybe 5) and adding a !@rx rule.
Expected behavior
I would expect !@rx to not trigger a rule if there's a MSC_PCRE_LIMITS_EXCEEDED error.
Server (please complete the following information):
- ModSecurity version (and connector): ModSecurity v3.0.12 with nginx-connector v1.0.3
- WebServer: nginx-1.24.0
- OS (and distro): Amazon Linux 2
Rule Set (please complete the following information):
- Running any public or commercial rule set? CRS
- What is the version number? 4.1.0
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.